CVE-2023-53926
Published: 17 December 2025
Description
PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify…
more
database information.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the specific SQL injection flaw in the 'column' parameter of PHPJabbers Simple CMS 5.0.
Mandates validation of untrusted inputs like the 'column' parameter to block crafted SQL payloads and prevent database query manipulation.
Ensures the organization receives, disseminates, and acts on security advisories such as VulnCheck's for this CVE to enable timely patching.
Security SummaryAI
PHPJabbers Simple CMS 5.0 is affected by CVE-2023-53926, a SQL injection vulnerability (CWE-89) in the 'column' parameter of the index.php endpoint. This flaw enables remote attackers to inject crafted SQL payloads, allowing manipulation of database queries to potentially extract or modify database information. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability without authentication or user interaction, as it requires no privileges (PR:N) and low complexity (AC:L). By sending malicious payloads via the 'column' parameter, attackers can achieve arbitrary database read or write operations, potentially dumping sensitive data or altering records.
Advisories and resources for mitigation include VulnCheck's detailed advisory at https://www.vulncheck.com/advisories/phpjabbers-simple-cms-sql-injection-via-column-parameter, a public exploit on Exploit-DB at https://www.exploit-db.com/exploits/51416, and the vendor's FAQ at https://www.phpjabbers.com/faq.php, which may offer patching or configuration guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in public-facing CMS directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary database read/write for data collection from databases (T1213.006).